Privacy notice

How OumsAI uses the personal data of the people who use the platform: store owners, their teams, and visitors to oumsai.com.

Who we are

OumsAI is run by BRODV LTD, a company registered in England and Wales under number 17069547, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("we"). We decide how your account data is used, so we are its controller.

Contact: hello@oumsai.com. For anything about your data, write to us there.

What we collect

Your account: name, email address, phone number if you give it, profile photo, password (stored only as a hash), two-factor and passkey settings. If someone invites you to a workspace, we receive your email address from them.

Your use of OumsAI: the workspaces you belong to and your role, what you do in them (kept in the activity history), where you are signed in (browser, IP address, times).

What you write to the AI assistant, and its answers.

Billing and payouts: your store's Stripe account details are held by Stripe; we keep its identifiers and status. Once paid plans start: your billing name and address, your VAT number and the result of its check, and the proof of your country that tax law requires; card details stay with Stripe.

If you request an invitation or write to us: your name, email address, company, website, what you sell, your message, the page you sent it from and the site that brought you there, and when you sent it, with the version of the notice shown on the form.

When you visit oumsai.com: technical data such as your IP address and browser, in our security logs.

Why we use it, and on what basis

To provide the service you signed up for: accounts, workspaces, stores, email, payments, the assistant (performance of our contract with you).

To answer an invitation request or a message, and to choose who joins the beta (steps you ask us to take before a contract, and our legitimate interest in choosing the beta's members).

To keep the platform secure: sign-in checks, rate limits, the activity history, security logs, fraud and abuse prevention (our legitimate interest in a safe service).

To meet legal duties: accounting, tax including VAT, answering lawful requests (legal obligation).

To tell you about changes to the service, to these texts and to your plan (performance of our contract, and legal obligation).

You need to give us your name and email address to have an account; without them we cannot provide the service.

We make no decision about you based solely on automated processing that has legal or similarly significant effects on you.

We do not sell your data and do not use it for advertising.

Your store's customers

For the data of your store's buyers and newsletter subscribers, your business is the controller and we act as your processor, under the Data processing agreement.

Who processes it for us

We share data with carefully chosen service providers: our hosting provider (servers in the European Union) and our email delivery provider (European Union), who process it on our behalf, under contract and only on our instructions; our payment provider, Stripe, for store payments and payouts and for our subscriptions, under its own terms and privacy policy; and AI service providers for the assistant and AI features (see "Transfers outside Europe"). You can ask us for the names of our providers at any time.

When needed, we also share data with our professional advisers, such as our accountant; with public authorities, when the law requires it; and with a buyer of our business, if it is sold, who would have to protect it as this notice says.

Transfers outside Europe

Your data is stored in the European Union. We are based in the United Kingdom: the European Union and the United Kingdom each recognise the other as protecting personal data to their standard (adequacy decisions).

Our AI service providers process the data they receive, including in China. Neither the European Union nor the United Kingdom has recognised China as protecting personal data to their standard, so your data may be less protected there, and local laws may give public authorities access to it. During the beta, our AI service provider in China may also keep what it receives and use it to improve its models. The legal basis for this transfer is under legal review. Avoid putting personal or sensitive data in what you send to the AI; a workspace can switch the AI assistant off in Settings → AI.

Our payment provider may process data in the United States, under the EU–US Data Privacy Framework and its UK extension.

How long we keep it

Your account data, while your account exists; when you delete it, within 30 days, except what the law requires us to keep.

The activity history, for the period your workspace sets (by default 365 days).

Sign-in records and security logs, 90 days. Invoices and accounting records, as long as tax law requires (up to 10 years).

Invitation requests and messages to us, up to 3 years after our last contact, unless you become a customer.

Our encrypted backups are replaced in rotation: deleted data disappears from them within a further 60 days, and is not used meanwhile except to restore the service.

Your rights

You can access, correct, export or delete your data, object to or restrict its use, and withdraw a consent you gave. Most of it you can do yourself in My account; for the rest, write to hello@oumsai.com.

You can complain to a data protection authority: in the United Kingdom the Information Commission (ICO, ico.org.uk), in France the CNIL (cnil.fr), or the authority where you live.

Security

We protect your data with technical and organisational measures suited to the risk, including encryption, access controls and regular encrypted backups.

Cookies

OumsAI uses only the cookies it needs to work and to remember your choices: your session, protection against forged requests, keeping you signed in if you ask, and your display preferences. No advertising, tracking or analytics cookies. Our Cookies policy lists each of them.

Changes

We will tell you by email before a change that affects your rights takes effect.